Two fixes for the same Write chunk payload corruption meet in
linux-next. In the nfs tree, commit a0db57fee35e ("xprtrdma: Fix Write
chunk payload corruption on a short reply header") trims
head[0].iov_len in rpcrdma_decode_msg(). In the nfs-anna tree,
commit 9ee534a75912 ("xprtrdma: trim head iovec when the payload
arrives via a Write chunk") trims it in rpcrdma_inline_fixup() and
reduces buflen by the same amount.

The merge resolution keeps the caller-side trim. By the time
rpcrdma_inline_fixup() runs, head[0].iov_len already equals copy_len,
so the block added by the nfs-anna commit never runs and its buflen
reduction in rq_rcv_buf and rq_private_buf is lost. The helper is also
still passed xdr_pad_size(writelist), while its kernel-doc now
describes @writelist as the number of bytes conveyed by the Write
chunk.

Drop the caller-side trim and pass the full Write chunk length, so
that rpcrdma_inline_fixup() is the only place that trims head[0] and
reduces buflen. Compute the pad with xdr_pad_size() in the helper, so
the padding from the nfs commit stays correct for lengths that are not
a multiple of four. Its rpclen calculation and empty reply check stay
in rpcrdma_decode_msg().

Fixes: 53ab189bdc14 ("Merge branch 'linux-next' of git://git.linux-nfs.org/projects/anna/linux-nfs.git")
Link: https://lore.kernel.org/all/as4aacUf2Q78FMvY@sirena.org.uk/
Signed-off-by: Sasha Levin <sashal@kernel.org>
Tested-by: Tim Menninger <tmenninger@everpuredata.com>
Reviewed-by: Tim Menninger <tmenninger@everpuredata.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull nfs client updates from Anna Schumaker:
 "New Features:
   - Modernize the direct I/O path
   - Size the LAYOUTGET reply buffer for wide flexfiles layouts
   - Flexfiles device notifications and caching for wide striped layouts
   - isolate mTLS client credentials by network namespace

  Bugfixes:
   - Various localio, flexfiles, xprtrdma, and TLS fixes
   - Merged bugfixes from Trond that he was unable to send during the 7.3-rc cycle

  Other Cleanups and Improvements:
   - Split up pNFS block layout and SCSI layout support"

* tag 'nfs-for-7.4-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (68 commits)
  nfs/localio: pin UUIDs during global invalidation
  NFSv4/flexfiles: fail I/O to the data server once a lock is lost
  pNFS/flexfiles: don't report an interrupted DS connect as a DS error
  pNFS/flexfiles: make pg_init retry loops killable
  nfsv4/pnfs: use the MDS authflavor for data server connections
  xprtrdma: trim head iovec when the payload arrives via a Write chunk
  nfs: set gencount on protocol-specific remove
  xprtrdma: prevent disconnect feedback during endpoint teardown
  NFS: add a key type that reveals the namespace .nfs keyring serial number
  NFS: name the namespace .nfs keyring in the x509 handshake
  SUNRPC: pass a keyring serial number to the TLS handshake
  NFS: allocate the .nfs keyring per network namespace
  NFS: name the init_nfs_fs() error labels
  NFS: return DENIED in decode_lock_denied if we cannot decode owner
  pNFS/flexfiles: don't reset to MDS for v4 error when previous layout forbid it
  pNFS/flexfiles: don't read through MDS when previous layout forbid it
  pNFS/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS over the mdsthreshold hint
  NFS/localio: report the stability a DIO WRITE actually has
  NFS/localio: detect a short read or write before the iterator has moved
  NFS/localio: fix nfs_local_dio_misaligned tracepoint
  ...

Pull nfsd updates from Chuck Lever:
 "Jeff Layton extended the netlink listener-set operation so that
  a management daemon can register NFSD's programs with rpcbind
  itself. This prevents an unresponsive rpcbind from stalling NFSD
  administration for a minute at a time.

  Bulk delegation recall now adjusts the number of delegations it
  wants returned, based on memory pressure. The previous mechanism
  was spec-conformant, but it requested all delegations to be
  returned at once. Clients are free to return few or none in such
  cases, but requesting smaller batches of delegations is more
  neighborly.

  In preparation for handling TLS KeyUpdate, the server's TCP
  receive path has been reworked to handle control records. In the
  process, the use of sock_recvmsg was replaced with ->read_sock,
  which contends less with other holders of the socket lock.

  NFSv2 XDR code is now generated by xdrgen, which mechanically
  generates the encoders and decoders from the RPC language
  specification for the protocol. Replacing hand-built XDR code
  makes prototyping new protocol elements faster, reduces errors,
  and improves memory safety. Replacement of XDR code for newer NFS
  versions will continue in subsequent releases of NFSD.

  The remaining bulk of changes in v7.4 is bug fixes, clean-ups, and
  small optimizations. Sincere thanks to all contributors,
  reviewers, testers, and bug reporters who participated in the v7.4
  NFSD development cycle"

* tag 'nfsd-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (184 commits)
  SUNRPC: use assign_bit() where applicable
  nfsd: Fix id-to-name cache entry leak in idtoname_parse()
  NFSD: Use xdrgen XDR functions for NFSv2 READDIR results
  NFSD: Refactor NFSv2 directory cookie encoding
  NFSD: Add a streaming directory reader
  NFSD: Use xdrgen XDR functions for NFSv2 READDIR arguments
  NFSD: Use xdrgen XDR functions for the NFSv2 STATFS procedure
  NFSD: Use xdrgen XDR functions for NFSv2 RMDIR procedure
  NFSD: Use xdrgen XDR functions for NFSv2 MKDIR procedure
  NFSD: Use xdrgen XDR functions for NFSv2 SYMLINK procedure
  NFSD: Use xdrgen XDR functions for the NFSv2 LINK procedure
  NFSD: Use xdrgen XDR functions for the NFSv2 RENAME procedure
  NFSD: Use xdrgen XDR functions for the NFSv2 REMOVE procedure
  NFSD: Use xdrgen XDR functions for NFSv2 CREATE procedure
  NFSD: Refactor nfsd_proc_create()
  NFSD: Use xdrgen XDR functions for NFSv2 WRITE procedure
  NFSD: Use xdrgen XDR functions for the NFSv2 WRITECACHE procedure
  NFSD: Use xdrgen XDR functions for NFSv2 READ procedure
  NFSD: Use xdrgen XDR functions for NFSv2 READLINK procedure
  NFSD: Use xdrgen XDR functions for the NFSv2 LOOKUP procedure
  ...

This pulls in NFS client bugfixes from the Linux 7.3-rc cycle that were
never sent upstream.

Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>

The upper layer sets rq_rcv_buf.head[0].iov_len from its estimate of the
reply header size. For RPCSEC_GSS that estimate includes
auth->au_ralign, which gss_create_new() initializes to GSS_VERF_SLACK >>
2 (25 XDR words, or 100 bytes) and which is corrected to the real
verifier size only after the first reply on that rpc_auth has been
unwrapped. In this case, the krb5 MIC verifier is 36 bytes, so every
request encoded before the first reply completes has a head that is 64
bytes too long.

On TCP this is harmless: xdr_realign_pages() moves the excess head
bytes, which are genuine reply data, into the page list. With
RPC-over-RDMA and a Write chunk (sec=krb5, i.e. RPC_GSS_SVC_NONE, where
DDP is allowed), the payload has already been placed directly into the
page list, and the receive buffer holds only the inline part of the
reply. rpcrdma_inline_fixup() clamps its local copy of the head length
to the inline length but leaves head.iov_len untouched, so
xdr_realign_pages() still sees iov_len > cur and shifts whatever lies
past the inline reply in the receive buffer into the front of the
directly-placed payload:

  rpc_xdr_recvfrom:  head=[...,196] page=524288 tail=[...,64]
  rpc_xdr_alignment: nfsv4 READ offset=132 copied=64

The first 64 bytes returned by each such READ are incorrect (zeroed, or
shifted right by 64 bytes depending on the kernel's xdr_shrink_bufhead()
implementation). This is readily hit with pNFS flexfiles over RDMA and
sec=krb5: the per-DS rpc_clnt gets a fresh rpc_auth whose first RPC is a
large READ. Reads following the first completed reply return the
expected data.

Commit cb0ae1fbb2f5 ("xprtrdma: Do not update {head, tail}.iov_len in
rpcrdma_inline_fixup()") removed the head-length correction while fixing
the handling of pure-inline krb5p replies.

When a Write chunk conveyed the payload, trim head.iov_len (in both
rq_rcv_buf and rq_private_buf, which call_decode() expects to match) to
the inline length actually received so that the XDR layer does not
realign the page list. These READ replies have no trailing inline
fields, and the payload is already in the page list, so the upper
layer's head estimate can be safely reduced. Reduce buflen by the same
amount to avoid treating unused head capacity as additional tail
capacity. Pure inline replies and Reply chunk replies are unchanged.

Tested on Linux 6.8.0 and 7.3-rc4 with NFSv4.1 pNFS flexfiles over
RPC/RDMA and sec=krb5.

Fixes: cb0ae1fbb2f5 ("xprtrdma: Do not update {head, tail}.iov_len in rpcrdma_inline_fixup()")
Cc: stable@vger.kernel.org
Signed-off-by: Yongjian Mu <ymu@everpuredata.com>
Reviewed-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Tim Menninger <tmenninger@everpuredata.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>

xprt_autoclose() clears XPRT_CLOSE_WAIT before invoking the transport's
->close() operation. For RPC/RDMA, ->close() calls
rpcrdma_xprt_disconnect(), which disconnects the RDMA CM endpoint and
drains its QP.

Since commit 31e62d25b5b8 ("xprtrdma: Simplify RPC wake-ups on
connect"), RDMA_CM_EVENT_DISCONNECTED requests a SUNRPC transport
disconnect. Today that path, along with failed completion handling,
reaches xprt_force_disconnect() through rpcrdma_force_disconnect().

Commit c487eb7d8e41 ("xprtrdma: Clean up disconnect") later added
re_force_disconnect to ensure that multiple failure indications request
only one SUNRPC disconnect. However, the gate remains open when SUNRPC
itself begins endpoint teardown.

If re_force_disconnect is still clear, either a CM disconnect event or a
completion error can set XPRT_CLOSE_WAIT again while the current close
is in progress. When the transport send lock is subsequently released,
xprt_clear_locked() observes XPRT_CLOSE_WAIT and queues another
autoclose.

Requesting a disconnect this way is necessary when a connection is lost
unexpectedly, but not when the event was generated by
rpcrdma_xprt_disconnect() itself. In that case SUNRPC is already
committed to closing the transport.

Mark re_force_disconnect before initiating local endpoint teardown so
that CM events and completion errors caused by that teardown cannot
request another close. An unexpected error that wins the race before
local endpoint teardown begins can still request a disconnect normally.

Use a fully ordered exchange so that the gate is globally closed before
rdma_disconnect() can transition the QP to error and generate the
callbacks that the gate suppresses.

In 30-second traces of a sustained recovery loop, without this change
there were 7,693 xprt_force_disconnect() calls, 6,267 SUNRPC autocloses,
and 172,892 receive-side IB_WC_WR_FLUSH_ERR completions. With this
change, the same tracepoints recorded 3,512 xprt_force_disconnect()
calls, 3,212 autocloses, and 131,287 receive-side flush completions.
Thus QP teardown continues to produce flushed completions, but closing
the disconnect gate before teardown substantially reduces their
feedback into the SUNRPC close path.

Fixes: 31e62d25b5b8 ("xprtrdma: Simplify RPC wake-ups on connect")
Cc: stable@vger.kernel.org
Signed-off-by: Tim Menninger <tmenninger@everpuredata.com>
Reviewed-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>

The handshake upcall links the keyring named in ta_keyring into
tlshd's process keyring before tlshd reads the client certificate and
private key. That link is how tlshd gains possession of keys that
grant no user read permission. xprtsock never fills the field, so an
x509 handshake can present only keys that tlshd's own credentials can
read.

Add a keyring serial number to struct xprtsec_parms and pass it to
the x509 handshake, so an RPC client can name the keyring that holds
its credentials.

Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>

Convert open-coded if/else with set_bit/clear_bit the assign_bit API.

Done with Coccinelle semantic patch:
    // set_bit -> clear_bit => assign_bit

    @@
    expression cond, bit, addr;
    @@

    -if (cond)
    -        set_bit(bit, addr);
    -else
    -        clear_bit(bit, addr);
    +assign_bit(bit, addr, cond);

    @@
    expression cond, bit, addr;
    @@

    -if (cond)
    -        clear_bit(bit, addr);
    -else
    -        set_bit(bit, addr);
    +assign_bit(bit, addr, !cond);

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Link: https://patch.msgid.link/20260920022714.3145751-1-peng.fan@oss.nxp.com
Signed-off-by: Chuck Lever <cel@kernel.org>

svc_bind() creates the local rpcbind client, and svc_register() then
makes one synchronous call for each program and version. Both run under
the caller's mutex. A caller that registers from userland needs neither.

Add sv_no_rpcbind to struct svc_serv, and fix up the code to honor it.
No caller sets the flag yet, so behaviour does not change.

Assisted-by: LLM
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260915-nfsd-norpcb-v3-1-3c60d49ade02@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>

Use the new helpers instead of open coding the SOCK_NOSPACE
manipulation, so that TCP can later maintain a cheaper private
copy of this bit.

No functional change intended.

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Acked-by: Chuck Lever <cel@kernel.org>
Link: https://patch.msgid.link/20260929071743.23624-4-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>